6. Domain 5 — Identity and Access Management (13%)

Identity is the new perimeter. In a world where users work from anywhere on any device, and where applications live in multiple clouds, the network boundary has dissolved. What remains is identity — the only consistent control point that travels with the user regardless of location, device, or application. Domain 5 defines how that identity is established, verified, and used to make access decisions.

At 13% weight, IAM covers the full lifecycle from provisioning a new user identity through authenticating that identity at access time, authorizing specific actions, and eventually deprovisioning when the relationship ends. Every authentication failure, every privilege escalation, and every unauthorized access event represents a failure somewhere in this chain.

⚠️ Domain Trap: Domain 5 is semantically precise. Authentication ≠ authorization ≠ accountability — these are distinct steps in the access control chain, not interchangeable terms. SSO ≠ federation ≠ zero trust network access. MFA ≠ unbreakable. Exam questions routinely test whether you use these terms with surgical precision.